Protected fields fix

spec/ProtectedFields.spec.js

@@ -0,0 +1,125 @@
+describe('ProtectedFields', function() {
+  describe('interaction with legacy userSensitiveFields', function() {
+    it('should fall back on sensitive fields if protected fields are not configured', async function() {
+      const userSensitiveFields = ['phoneNumber', 'timeZone'];
+
+      const protectedFields = { _User: { '*': ['email'] } };
+
+      await reconfigureServer({ userSensitiveFields, protectedFields });
+      const user = new Parse.User();
+      user.setUsername('Alice');
+      user.setPassword('sekrit');
+      user.set('email', '[email protected]');
+      user.set('phoneNumber', 8675309);
+      user.set('timeZone', 'America/Los_Angeles');
+      user.set('favoriteColor', 'yellow');
+      user.set('favoriteFood', 'pizza');
+      await user.save();
+
+      const fetched = await new Parse.Query(Parse.User).get(user.id);
+      expect(fetched.has('email')).toBeFalsy();
+      expect(fetched.has('phoneNumber')).toBeFalsy();
+      expect(fetched.has('favoriteColor')).toBeTruthy();
+    });
+
+    it('should merge protected and sensitive for extra safety', async function() {
+      const userSensitiveFields = ['phoneNumber', 'timeZone'];
+
+      const protectedFields = { _User: { '*': ['email', 'favoriteFood'] } };
+
+      await reconfigureServer({ userSensitiveFields, protectedFields });
+      const user = new Parse.User();
+      user.setUsername('Alice');
+      user.setPassword('sekrit');
+      user.set('email', '[email protected]');
+      user.set('phoneNumber', 8675309);
+      user.set('timeZone', 'America/Los_Angeles');
+      user.set('favoriteColor', 'yellow');
+      user.set('favoriteFood', 'pizza');
+      await user.save();
+
+      const fetched = await new Parse.Query(Parse.User).get(user.id);
+      expect(fetched.has('email')).toBeFalsy();
+      expect(fetched.has('phoneNumber')).toBeFalsy();
+      expect(fetched.has('favoriteFood')).toBeFalsy();
+      expect(fetched.has('favoriteColor')).toBeTruthy();
+    });
+  });
+
+  describe('non user class', function() {
+    it('should hide fields in a non user class', async function() {
+      const protectedFields = {
+        ClassA: { '*': ['foo'] },
+        ClassB: { '*': ['bar'] },
+      };
+      await reconfigureServer({ protectedFields });
+
+      const objA = await new Parse.Object('ClassA')
+        .set('foo', 'zzz')
+        .set('bar', 'yyy')
+        .save();
+
+      const objB = await new Parse.Object('ClassB')
+        .set('foo', 'zzz')
+        .set('bar', 'yyy')
+        .save();
+
+      const [fetchedA, fetchedB] = await Promise.all([
+        new Parse.Query('ClassA').get(objA.id),
+        new Parse.Query('ClassB').get(objB.id),
+      ]);
+
+      expect(fetchedA.has('foo')).toBeFalsy();
+      expect(fetchedA.has('bar')).toBeTruthy();
+
+      expect(fetchedB.has('foo')).toBeTruthy();
+      expect(fetchedB.has('bar')).toBeFalsy();
+    });
+
+    it('should hide fields in non user class and non standard user field at same time', async function() {
+      const protectedFields = {
+        _User: { '*': ['phoneNumber'] },
+        ClassA: { '*': ['foo'] },
+        ClassB: { '*': ['bar'] },
+      };
+
+      await reconfigureServer({ protectedFields });
+
+      const user = new Parse.User();
+      user.setUsername('Alice');
+      user.setPassword('sekrit');
+      user.set('email', '[email protected]');
+      user.set('phoneNumber', 8675309);
+      user.set('timeZone', 'America/Los_Angeles');
+      user.set('favoriteColor', 'yellow');
+      user.set('favoriteFood', 'pizza');
+      await user.save();
+
+      const objA = await new Parse.Object('ClassA')
+        .set('foo', 'zzz')
+        .set('bar', 'yyy')
+        .save();
+
+      const objB = await new Parse.Object('ClassB')
+        .set('foo', 'zzz')
+        .set('bar', 'yyy')
+        .save();
+
+      const [fetchedUser, fetchedA, fetchedB] = await Promise.all([
+        new Parse.Query(Parse.User).get(user.id),
+        new Parse.Query('ClassA').get(objA.id),
+        new Parse.Query('ClassB').get(objB.id),
+      ]);
+
+      expect(fetchedA.has('foo')).toBeFalsy();
+      expect(fetchedA.has('bar')).toBeTruthy();
+
+      expect(fetchedB.has('foo')).toBeTruthy();
+      expect(fetchedB.has('bar')).toBeFalsy();
+
+      expect(fetchedUser.has('email')).toBeFalsy();
+      expect(fetchedUser.has('phoneNumber')).toBeFalsy();
+      expect(fetchedUser.has('favoriteColor')).toBeTruthy();
+    });
+  });
+});

spec/UserPII.spec.js

@@ -553,7 +553,7 @@ describe('Personally Identifiable Information', () => {
         done();
       });
 
-      it('privilaged user should not be able to get user PII via API with object', done => {
+      it('privileged user should not be able to get user PII via API with object', done => {
         const userObj = new (Parse.Object.extend(Parse.User))();
         userObj.id = user.id;
         userObj
@@ -565,7 +565,7 @@ describe('Personally Identifiable Information', () => {
           .catch(done.fail);
       });
 
-      it('privilaged user should not be able to get user PII via API with Find', done => {
+      it('privileged user should not be able to get user PII via API with Find', done => {
         new Parse.Query(Parse.User)
           .equalTo('objectId', user.id)
           .find()
@@ -579,7 +579,7 @@ describe('Personally Identifiable Information', () => {
           .catch(done.fail);
       });
 
-      it('privilaged user should not be able to get user PII via API with Get', done => {
+      it('privileged user should not be able to get user PII via API with Get', done => {
         new Parse.Query(Parse.User)
           .get(user.id)
           .then(fetchedUser => {
@@ -591,7 +591,7 @@ describe('Personally Identifiable Information', () => {
           .catch(done.fail);
       });
 
-      it('privilaged user should not get user PII via REST by ID', done => {
+      it('privileged user should not get user PII via REST by ID', done => {
         request({
           url: `http://localhost:8378/1/classes/_User/${user.id}`,
           json: true,
@@ -995,7 +995,7 @@ describe('Personally Identifiable Information', () => {
     });
 
     // Explicit ACL should be able to read sensitive information
-    describe('with privilaged user CLP', () => {
+    describe('with privileged user CLP', () => {
       let adminUser;
 
       beforeEach(async done => {
@@ -1025,7 +1025,7 @@ describe('Personally Identifiable Information', () => {
         done();
       });
 
-      it('privilaged user should be able to get user PII via API with object', done => {
+      it('privileged user should be able to get user PII via API with object', done => {
         const userObj = new (Parse.Object.extend(Parse.User))();
         userObj.id = user.id;
         userObj
@@ -1037,7 +1037,7 @@ describe('Personally Identifiable Information', () => {
           .catch(done.fail);
       });
 
-      it('privilaged user should be able to get user PII via API with Find', done => {
+      it('privileged user should be able to get user PII via API with Find', done => {
         new Parse.Query(Parse.User)
           .equalTo('objectId', user.id)
           .find()
@@ -1051,7 +1051,7 @@ describe('Personally Identifiable Information', () => {
           .catch(done.fail);
       });
 
-      it('privilaged user should be able to get user PII via API with Get', done => {
+      it('privileged user should be able to get user PII via API with Get', done => {
         new Parse.Query(Parse.User)
           .get(user.id)
           .then(fetchedUser => {
@@ -1063,7 +1063,7 @@ describe('Personally Identifiable Information', () => {
           .catch(done.fail);
       });
 
-      it('privilaged user should get user PII via REST by ID', done => {
+      it('privileged user should get user PII via REST by ID', done => {
         request({
           url: `http://localhost:8378/1/classes/_User/${user.id}`,
           json: true,

src/ParseServer.js

@@ -333,8 +333,6 @@ function addParseCloud() {
 }
 
 function injectDefaults(options: ParseServerOptions) {
-  const hasProtectedFields = !!options.protectedFields;
-
   Object.keys(defaults).forEach(key => {
     if (!options.hasOwnProperty(key)) {
       options[key] = defaults[key];
@@ -346,7 +344,7 @@ function injectDefaults(options: ParseServerOptions) {
   }
 
   // Backwards compatibility
-  if (!hasProtectedFields && options.userSensitiveFields) {
+  if (options.userSensitiveFields) {
     /* eslint-disable no-console */
     !process.env.TESTING &&
       console.warn(
@@ -361,7 +359,20 @@ function injectDefaults(options: ParseServerOptions) {
       ])
     );
 
-    options.protectedFields = { _User: { '*': userSensitiveFields } };
+    if (!('protectedFields' in options)) {
+      options.protectedFields = [];
+    }
+
+    if (!('_User' in options.protectedFields)) {
+      options.protectedFields['_User'] = [];
+    }
+
+    options.protectedFields['_User']['*'] = Array.from(
+      new Set([
+        ...(options.protectedFields['_User']['*'] || []),
+        ...userSensitiveFields,
+      ])
+    );
   }
 
   // Merge protectedFields options with defaults.